Windows Domain DFS namespace – access is denied using domain FQDN, access allowed using server UNC paths directly

Jul 24, 2014 | Windows

Original article

 

This was easily one of the most frustrating and ridiculous fun times I’ve had working with DFS.

The issue: At several client locations we run file server redundancy by offering (2) DFSR servers. A shared domain namespace with replicated folders to ensure they stay online if a server is offline for planned or unplanned good times. Within group-policy, we map folder redirection to a namespace path:

  • “documents” -> “domain.comusersusernamedocuments”
  • “desktop” -> “domain.comusersusernamedesktop”
  • ……

By referencing the namespace, it will redirect when server A or B is offline. This should NOT be used in WAN deployments, LAN is fast and therefore replication is fast. Initially the DFS issue was identified when drives mapped to the namespace were missing. Within the client event logs, we saw “access denied” errors associated with these drive-letters.

What we checked and verified:

  • Problematic client stations could not connect to “domain.comdfsroot”  (access denied)
  • Problematic client stations could not connect to “domaindfsroot” (access denied)
  • Problematic client stations could connect to “serverAdfsroot”
  • Problematic client stations could connect to “serverBdfsroot”
  • Permissions on the shares for the DFS Root folder were correctly set to “everyone” with read/write
  • Each of these systems was removed and rejoined to the domain [no success]
  • The local profiles were completely removed from the local systems (file system and registry) and logged back in [no success]
  • Security suites were removed [no success]
  • Each user was tested on working machines and had no issues obtaining the right drives

The culprit: 

  • When we disabled the ‘offline files’ component and rebooted -> “domain.comdfsroot” was immediately accessible
We ultimately came to this conclusion: 
The offline file cache was corrupt. When offline files are disabled, the system accesses the namespace location directly without issue. This confirms a reference to the namespace is clearly saved within offline file cache. If the cache is corrupt you end up with “Access is Denied”. Another quick way to determine if the issue is corrupt cache is to simply try and access the DFS root UNC paths on each server. If you can browse the contents when bypassing the shared namespace path, and this user has no issues on other domain PCs, then it’s not permissions.
………..
The Fix:
……….
1) Disable offline files

Control Panel -> Sync Center -> Manage Offline Files -> Disable Offline Files

2) Clear the offline file cache

This sets a temporary registry entry which is read on start-up and runs the cache wipe.
Elevated Command Prompt -> “reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCscParameters /v FormatDatabase /t REG_DWORD /d 1 /f “

3) Reboot

You must reboot to successfully wipe the offline file cache

4) Test the namespace path -> “domain.comdfsroot”

If you can now browse the namespace contents, you can optionally re-enable Offline Files.
We understand the Offline Files component is critical to road warriors. You should be safe to re-enable it and reboot.

Control Panel -> Sync Center -> Manage Offline Files -> Enable Offline Files -> Reboot

After you log back in, check that you can still access the namespace path “domain.comdfsroot” after you run a forced sync. If there are still issues, I recommend you follow the steps we initially took “What we checked and verified:” and repeat this fix.

Good luck!

 

READY FOR A CHANGE?

If you're ready to change the way your small business feels about technology, then we'd love to hear from you.